External Penetration Testing of IT Infrastructure

The contract is for external penetration testing of IT infrastructure under a subcontract arrangement, aimed at identifying and exploiting vulnerabilities within critical enterprise systems to assess security posture. The scope includes authorized testing activities that simulate real-world cyber threats, with a focus on environments deemed essential to operations, and requires detailed formal reporting of findings, risks, and remediation guidance. Work must be performed in accordance with strict authorization protocols and industry best practices to ensure no disruption to ongoing services. The opportunity is open for submission until August 4, 2026, and is classified under NAICS code 541330 for computer systems design and related services. The contracting entity is the Port Authority of New York and New Jersey, specifically their New York office, though the exact physical location for performance is unspecified. Interested parties must respond through the designated portal before the deadline, and while there is no set-aside designation, bidders are expected to demonstrate proven experience in conducting high-risk, high-impact penetration tests on complex infrastructure environments.